James Grimmelmann has an interesting piece on LawMeme concerning a strange side issue involving unauthorized access to one party's copyrighted works through Archive.org by a third party (From the Strange File: Archive.org Hacking in Civil Lawsuit?). There are many issues involved in the case, so read the whole thing, but one issue stuck out for me:
HAS is raising a striking issue here: third party standing to sue over violation of various computer security statutes. Take for example the DMCA claim. It presumably runs something like this. Access to our copyrighted works (the web pages) is effectively controlled by the technological measures in place at Archive.org. You circumvented those measures. We were injured as a result (I can see copyright infringement, plus possibly some of the other claims from the underlying lawsuit). Therefore, under sections 1201(a) and 1203(a) of the DMCA, you're liable to us. Ka-pow. [links in original]
To my eyes, however, this is not a striking claim with regard to the DMCA because I see it as the basis for the most famous DMCA case of all, the
MPAA anti-DeCSS cases:
EFF Archives: MPAA DVD Cases.
One issue I always thought wasn't properly raised in the MPAA cases was who really had the right to bring the lawsuit. The movie studios brought the lawsuit because it was their copyrighted works that were being "protected" by CSS copy protection. However, the movie studios have no rights in the CSS system. It is fully controlled by the DVDCCA. Even if the movie studios changed their mind and thought it would be okay to distribute DeCSS, they had no authority to do so. Only the DVDCCA can determine what is authorized with regard to CSS.
The MPAA's argument (if they had been forced to make one) would have had to go something like this: access to the MPAA's copyrighted works (the movies) is effectively controlled by the technological measures owned and controlled by the DVDCCA. DeCSS circumvented those measures, but it is the MPAA that is injured as a result. Thus, the MPAA gets to sue.
I argued at the time that this was incorrect, that the DVDCCA should be the only plaintiff in the suit or, at a minimum, the DVDCCA was a necessary party. Obviously, my arguments never got anywhere.
This issue may seem new because all the other DMCA cases I am aware of have been brought by the companies that actually control the DRM technology used, such as Real v. Streambox, Chamberlain v. Skylink, and Lexmark, to name but a few.
I still think it is important point, however, and it will be interesting to see what a court makes of it. The consequences can be tremendous. As a DRM creator who licenses use of the DRM system, does the DMCA mean that you lose all control over what you permit with regard to your DRM system to those you've licensed it to?
Ernest Miller pursues research and writing on cyberlaw, intellectual property, and First Amendment issues. Mr. Miller attended the U.S. Naval Academy before attending Yale Law School, where he was president and co-founder of the Law and Technology Society, and founded the technology law and policy news site LawMeme. He is a fellow of the Information Society Project at Yale Law School.
Ernest Miller's blog postings can also be found @
1. Seth Finkelstein on July 12, 2004 07:25 PM writes...
I think the court basically assumed the argument you give above:
"Plaintiffs, eight major United States motion picture studios,
distribute many of their copyrighted motion pictures for home use on digital
versatile disks ("DVDs"), which contain copies of the motion pictures in
digital form. They protect those motion pictures from copying by using an
encryption system called CSS."
Later:
"B. Parties
Plaintiffs are eight major motion picture studios. Each is in the business
of producing and distributing copyrighted material including motion
pictures. Each distributes, either directly or through affiliates,
copyrighted motion pictures on DVDs. [FN34] Plaintiffs produce and
distribute a large majority of the motion pictures on DVDs on the market
today. [FN35]"
Permalink to Comment2. Ernest Miller on July 12, 2004 07:27 PM writes...
Indeed the court did. But I think a closer reading of the law and the rights the motion pictures studios have in CSS would have changed that.
Permalink to Comment3. Seth Finkelstein on July 12, 2004 08:04 PM writes...
??? I'm not a lawyer, but doesn't Section 1203 make standing broad?
http://www.copyright.gov/title17/92chap12.html
§ 1203. Civil remedies
(a) Civil Actions. -- Any person injured by a violation of section 1201 or 1202 may bring a civil action in an appropriate
United States district court for such violation.
Permalink to CommentIf you mean to argue that the only party which could be "injured" in a DMCA sense by circumvention tools, is the creator of the technological measure itself, that seems contrary to the whole idea of the DMCA (not that I'm agreeing, mind you, but such a narrow construction doesn't seem reasonable)
4. Ernest Miller on July 12, 2004 08:41 PM writes...
Imagine this scenario. "A" creates a DRM system. "A" provides a license to "B" to utilize it to protect B's copyrighted works, but "A" has no obligation to B to prevent circumvention. "C" comes along and creates a circumvention device. "A" actually thinks this circumvention device is cool for whatever reason and doesn't want to see it taken off the market. Should "B" be permitted to sue "C" because of circumvention of "A"'s DRM? Shouldn't "A" be, at the very least, a necessary party to the lawsuit? Depending on the specific language of "B"'s license, might not "A" be the only person who could sue?
Real sued Steambox, but I've used Real's technology to "protect" my copyright audio recordings. Could I have sued Streambox even against Real's desire? Who controls the DRM, the copyright holder, or the holder of the rights in the DRM? If tomorrow, Real, decides to enable recording for all streams, can I, as a copyright holder, sue Real under the DMCA?
I argue that you can't claim you're injured under 1201 unless you have some right to control how the DRM is implemented and used. If you use DRM under a license that says, "you can use it, but you have no rights to control how we implement it" how can you claim you've been harmed? The only one who can claim that is the organization with the control. The license provided by the DVDCCA retain all rights in how DRM is implemented and used.
Permalink to Comment5. Seth Finkelstein on July 13, 2004 03:17 PM writes...
First, here's a more on-point portion of the DeCSS case:
"IV. Relief
A. Injury to Plaintiffs
The DMCA provides that "[a]ny person injured by a violation of section 1201 or 1202 may bring a civil action in an appropriate United States court for such violation." [FN259. 17 U.S.C. S 1203(a)] For the reasons set forth above, plaintiffs obviously have suffered and, absent effective relief, will continue to suffer injury by virtue of the ready availability of means of circumventing the CSS access control system on their DVDs."
The DMCA grants rights to copyright-owners. It has very little to do with licensing rights or wishs of DRM system creators, if these interests are different from the copyright-owners.
Again, it makes "DMCA-sense" that standing encompasses copyright-owners, since they have the most at stake. Could one create a hypothetical situation where there was a tangle of conflicting interests between the copyright-owners and the DRM system rights owner? Sure. But where would that mean the DRM system owner is always a necessary party to a DMCA lawsuit? It's not a joint system, each party can act in its own interests.
Thinking about, I'd say, yes, a copyright owner does have standing to sue under the DMCA *even if* the DRM system owner approves of the circumvention device for some strange reason. It's just a separate right.
The claim to harm is the affect on the copyrights you own. That's the point of the DMCA, the "para-copyright". You get not only rights against copying the content, but rights against the act or tools which circumvent the *methods* used to control access and copying of the content.
Once more, I'm not saying I like this, it's a very far-ranging change. But the reasoning is not irrational if one grants the goals for the sake of discussion.
Permalink to Comment6. Ernest Miller on July 13, 2004 03:20 PM writes...
Seth,
You may very well be right, but I think that the creators of DRM may not like this idea very much and will fight it. There are plausible arguments on both sides. What I would like to see is a case that directly addressed the question.
Permalink to Comment